Elastic low stable kql

System Owner/User Discovery Linux

Identifies the use of built-in tools which adversaries may use to enumerate the system owner/user of a compromised system.

View Source

Detection Logic

event.category:process and host.os.type:linux and event.type:start and event.action:(exec or exec_event or start) and
process.name:("whoami" or "w" or "who" or "users" or "id" or "groups")

Field Validations

Loading…

Comments (0)

Loading comments...